X
Tap here to go to the mobile version of the site.

Support Forum

Spam Bookmarks Found in "Other Folders". Help.

Posted

Hello Mozilla Support. A list of porn video, chat, webcam and sex-hook-up bookmarks have been found in "Other Folders" on my PC which I have never put there. This has caused a great deal of distress and although difficult, I desperately would like help to confirm/prove that these were placed there by some type malicious source like Adware or Malware and not by me. This has happened on a Windows XP OS using Mozilla Firefox. The PC was erased and reformatted in approx 2012-13, and these links were found in this folder around 12 months ago in 2016. (Please see attachment) I never use or even look in that folder, so I had no idea that they were there, or from when. All of the link URLs are a mile long, which is unlike all the other bookmarks that I have saved everywhere else on this PC. Most/all of which simply end after the ".com", or ".com/forum" etc and that includes those that I am automatically logged in to. Has this been seen before? Is anyone aware of this? Is anyone aware of the possible cause? As much information as possible is greatly appreciated. Thank you for your time and help. Steve.

Hello Mozilla Support. A list of porn video, chat, webcam and sex-hook-up bookmarks have been found in "Other Folders" on my PC which I have never put there. This has caused a great deal of distress and although difficult, I desperately would like help to confirm/prove that these were placed there by some type malicious source like Adware or Malware and not by me. This has happened on a Windows XP OS using Mozilla Firefox. The PC was erased and reformatted in approx 2012-13, and these links were found in this folder around 12 months ago in 2016. (Please see attachment) I never use or even look in that folder, so I had no idea that they were there, or from when. All of the link URLs are a mile long, which is unlike all the other bookmarks that I have saved everywhere else on this PC. Most/all of which simply end after the ".com", or ".com/forum" etc and that includes those that I am automatically logged in to. Has this been seen before? Is anyone aware of this? Is anyone aware of the possible cause? As much information as possible is greatly appreciated. Thank you for your time and help. Steve.
Attached screenshots

Chosen solution

Do you have any backups of your bookmarks from before you deleted the unwanted ones? Here's one place to check:

Open your current Firefox settings (AKA Firefox profile) folder using either

  • "3-bar" menu button > "?" button > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter

In the first table on the page, click the "Open Folder" button. This should launch a new window listing various files and folders in Windows Explorer.

Find the bookmarkbackups folder and double-click into that. Backup files have the date coded into the file name.

If anything looks promising, you can restore the file to a NEW PROFILE, not your current profile, because that would overwrite your existing bookmarks. Keep this folder open so you can easily copy the path from the address bar.

New Profile

This takes about 3 minutes, plus the time to restore the backup.

Inside Firefox, type or paste about:profiles in the address bar and press Enter/Return to load it.

Click the Create a New Profile button, then click Next. Assign a name like Aug2017, ignore the option to relocate the profile folder, and click the Finish button.

After creating the profile, scroll down to it and click the Set as default profile button below that profile, then scroll back up and click the Restart normally button. (There are some other buttons, but I think those are still "under construction" so please ignore them.)

Firefox should exit and then start up using the new profile, which will just look brand new.

This article describes the Restore feature. You can use "Choose File" to apply one of the bookmark backups from your old profile to the new one. This is where you'll need to refer to (or copy/paste from) the address bar of the other window.

When you are done with the experiment, open the about:profiles page again, click the Set as default profile button for your normal profile, then click the Restart normally button to get back to it.

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Shockwave Flash 26.0 r0

Application

  • User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

More Information

Question owner

Attachment enlarged.

Attachment enlarged.
cor-el
  • Top 10 Contributor
  • Moderator
17519 solutions 158415 answers

Bookmarks that show in the "Other Bookmarks" folder were created by clicking the star on the Navigation Toolbar. Maybe check details like the added data and the most recent visit date in the Bookmarks Manager (Library). You can right-click the header bar in the Library to set which columns to display (View -> Columns).

Bookmarks that show in the "Other Bookmarks" folder were created by clicking the star on the Navigation Toolbar. Maybe check details like the added data and the most recent visit date in the Bookmarks Manager (Library). You can right-click the header bar in the Library to set which columns to display (View -> Columns).

Question owner

Thank you. Yes, I am aware of how bookmarks are created. However, I have never visited those websites, let alone ever chosen to add them.

https://support.mozilla.org/en-US/questions/1147295

Thank you. Yes, I am aware of how bookmarks are created. However, I have never visited those websites, let alone ever chosen to add them. https://support.mozilla.org/en-US/questions/1147295
cor-el
  • Top 10 Contributor
  • Moderator
17519 solutions 158415 answers

Were these bookmarks recently added or are they old?

Did you ever had malware on your computer?

Were these bookmarks recently added or are they old? Did you ever had malware on your computer? *https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Question owner

Please re-read the opening post. " The PC was erased and reformatted in approx 2012-13, and these links were found in this folder around 12 months ago in 2016."

Please re-read the opening post. " The PC was erased and reformatted in approx 2012-13, and these links were found in this folder around 12 months ago in 2016."

Question owner

As for Malware. I do recall a couple of the symptoms on the link you have posted, but can't say for sure if Malware. Possible. Since the reformatting, I have since had Kapersky anti-virus.

As for Malware. I do recall a couple of the symptoms on the link you have posted, but can't say for sure if Malware. Possible. Since the reformatting, I have since had Kapersky anti-virus.

Question owner

FWIW. When I add bookmarks which is reasonably often, I always place them directly into the folder I want them in and never "Other Bookmarks". I have not ever used "Other Bookmarks". So, why are there none of my normal bookmarks in the "Other Bookmarks" with the spam links? The Google Search link at the very bottom of the list was also related in terms of porn.

FWIW. When I add bookmarks which is reasonably often, I always place them directly into the folder I want them in and never "Other Bookmarks". I have not ever used "Other Bookmarks". So, why are there none of my normal bookmarks in the "Other Bookmarks" with the spam links? The Google Search link at the very bottom of the list was also related in terms of porn.

Question owner

Still hoping for help on this please. Special attention to Moderator Seburo https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

A list of porn video, chat, webcam and sex-hook-up bookmarks have been found in "Other Folders" on my PC which I have never put there. This has caused a great deal of distress and although difficult, I desperately would like help to confirm/prove that these were placed there by some type malicious source like Adware or Malware and not by me.

Has this been seen before? Is anyone aware of this? Is anyone aware of the possible cause? As much information as possible is greatly appreciated. Thank you for your time and help. Steve.

Thank you.

Still hoping for help on this please. Special attention to Moderator '''Seburo''' https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware A list of porn video, chat, webcam and sex-hook-up bookmarks have been found in "Other Folders" on my PC which I have never put there. This has caused a great deal of distress and although difficult, I desperately would like help to confirm/prove that these were placed there by some type malicious source like Adware or Malware and not by me. Has this been seen before? Is anyone aware of this? Is anyone aware of the possible cause? As much information as possible is greatly appreciated. Thank you for your time and help. Steve. Thank you.
Scribe 728 solutions 3470 answers

Hi, this sounds like malware or someone getting access to your PC.

Assuming you're certain no-one has had access to it - repairs/servicing etc.

  • Do you use sync? If so, the bookmarks may have been saved on another device you are connected to.
  • Check your add-ons for anything suspicious: Add-ons Manager (Ctrl+Shift+A) > Extensions/Plugins. (A suspect plugin will need to be uninstalled from your PCs programs.)
  • Look at the date they were added for clues: Bookmarks > Show all bookmarks > Views (on toolbar) > Show columns, and select 'Added.'
  • Do they come back if you right click >Delete them?

You can try these free programs to scan for malware, which work with your existing antivirus software:

Note that not all removal programs will detect all malware, so you may need to run several or all of them.

Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Did this fix your problems? Please report back to us. Thank you!

Hi, this sounds like malware or someone getting access to your PC. Assuming you're certain no-one has had access to it - repairs/servicing etc. * Do you use sync? If so, the bookmarks may have been saved on another device you are connected to. *Check your add-ons for anything suspicious: Add-ons Manager (Ctrl+Shift+A) > Extensions/Plugins. (A suspect plugin will need to be uninstalled from your PCs programs.) *Look at the date they were added for clues: Bookmarks > Show all bookmarks > Views (on toolbar) > Show columns, and select 'Added.' * Do they come back if you right click >Delete them? ------------------- You can try these free programs to scan for malware, which work with your existing antivirus software: * [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner] * [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware] * [http://support.kaspersky.com/viruses/disinfection/5350 Anti-Rootkit Utility - TDSSKiller] * [http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner AdwCleaner] (for more info, see this [http://www.bleepingcomputer.com/download/adwcleaner/ alternate AdwCleaner download page]) * [http://www.surfright.nl/en/hitmanpro/ Hitman Pro] * [http://www.eset.com/us/online-scanner/ ESET Online Scanner] '''Note that not all removal programs will detect all malware, so you may need to run several or all of them.''' Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article. Did this fix your problems? Please report back to us. Thank you!

Question owner

No, my PC is not synced to any other device. Unfortunately the book marks have been deleted. I tried to find out when they were added but didn't know how and figured it was not possible.

Can they be recovered? I'd really like to find out this information.

No, my PC is not synced to any other device. Unfortunately the book marks have been deleted. I tried to find out when they were added but didn't know how and figured it was not possible. Can they be recovered? I'd really like to find out this information.
jscher2000
  • Top 10 Contributor
8758 solutions 71655 answers

Chosen Solution

Do you have any backups of your bookmarks from before you deleted the unwanted ones? Here's one place to check:

Open your current Firefox settings (AKA Firefox profile) folder using either

  • "3-bar" menu button > "?" button > Troubleshooting Information
  • (menu bar) Help > Troubleshooting Information
  • type or paste about:support in the address bar and press Enter

In the first table on the page, click the "Open Folder" button. This should launch a new window listing various files and folders in Windows Explorer.

Find the bookmarkbackups folder and double-click into that. Backup files have the date coded into the file name.

If anything looks promising, you can restore the file to a NEW PROFILE, not your current profile, because that would overwrite your existing bookmarks. Keep this folder open so you can easily copy the path from the address bar.

New Profile

This takes about 3 minutes, plus the time to restore the backup.

Inside Firefox, type or paste about:profiles in the address bar and press Enter/Return to load it.

Click the Create a New Profile button, then click Next. Assign a name like Aug2017, ignore the option to relocate the profile folder, and click the Finish button.

After creating the profile, scroll down to it and click the Set as default profile button below that profile, then scroll back up and click the Restart normally button. (There are some other buttons, but I think those are still "under construction" so please ignore them.)

Firefox should exit and then start up using the new profile, which will just look brand new.

This article describes the Restore feature. You can use "Choose File" to apply one of the bookmark backups from your old profile to the new one. This is where you'll need to refer to (or copy/paste from) the address bar of the other window.

When you are done with the experiment, open the about:profiles page again, click the Set as default profile button for your normal profile, then click the Restart normally button to get back to it.

Do you have any backups of your bookmarks from before you deleted the unwanted ones? Here's one place to check: Open your current Firefox settings (AKA Firefox profile) folder using either * "3-bar" menu button > "?" button > Troubleshooting Information * (menu bar) Help > Troubleshooting Information * type or paste about:support in the address bar and press Enter In the first table on the page, click the "Open Folder" button. This should launch a new window listing various files and folders in Windows Explorer. Find the '''bookmarkbackups''' folder and double-click into that. Backup files have the date coded into the file name. If anything looks promising, you can restore the file to a NEW PROFILE, not your current profile, because that would overwrite your existing bookmarks. Keep this folder open so you can easily copy the path from the address bar. '''New Profile''' This takes about 3 minutes, plus the time to restore the backup. Inside Firefox, type or paste '''about:profiles''' in the address bar and press Enter/Return to load it. Click the Create a New Profile button, then click Next. Assign a name like Aug2017, ignore the option to relocate the profile folder, and click the Finish button. After creating the profile, scroll down to it and click the '''Set as default profile''' button below that profile, then scroll back up and click the '''Restart normally''' button. (There are some other buttons, but I think those are still "under construction" so please ignore them.) Firefox should exit and then start up using the new profile, which will just look brand new. This article describes the Restore feature. You can use "Choose File" to apply one of the bookmark backups from your old profile to the new one. This is where you'll need to refer to (or copy/paste from) the address bar of the other window. When you are done with the experiment, open the about:profiles page again, click the '''Set as default profile''' button for your normal profile, then click the '''Restart normally''' button to get back to it.
jscher2000
  • Top 10 Contributor
8758 solutions 71655 answers

Oh, if are you able to restore a backup, you can view the Other Bookmarks folder in the Library window ("Show All Bookmarks") . You can right-click one of the column headings to drop down a list of available data categories, one of which is Added.

Oh, if are you able to restore a backup, you can view the Other Bookmarks folder in the Library window ("Show All Bookmarks") . You can right-click one of the column headings to drop down a list of available data categories, one of which is Added.

Modified by jscher2000

Question owner

Yes, thank you very much. I was able to restore these bookmarks from the earliest restore file in 2015 and they all came in, one by one between March 2013 and March 2014.

I looked at several restore files and found that these links are the only items that were in "Other Folders"

Like I said, I never used this folder. I had no idea they were there.

Yes, thank you very much. I was able to restore these bookmarks from the earliest restore file in 2015 and they all came in, one by one between March 2013 and March 2014. I looked at several restore files and found that these links are the only items that were in "Other Folders" Like I said, I never used this folder. I had no idea they were there.

Question owner

Still I can only assume that Malware put them there. I'll see if I can confirm that with the information you have provided.

Still I can only assume that Malware put them there. I'll see if I can confirm that with the information you have provided.

Question owner

(having trouble uploading image)

(having trouble uploading image)
Tyler Downer
  • Top 25 Contributor
  • Moderator
1534 solutions 10700 answers

(I worked in home computer repair for many years before coming to Mozilla and I've seen it all, so don't get offended when I give you my honest opinion)

This is a case of one of the following being true:

  1. (Most likely) Someone who had access to your computer created these bookmarks. Younger Siblings, Spouse, Nieces and Nephews, Grandparents, etc. It may be that these were created in another browser (like IE) and then imported into Firefox, but that's the most likely story of how they came to be.
  2. (If the above is absolutely not possible) Then Malware created those bookmarks, though in all my years of experience very few malware infections would create bookmarks, it is possible. I'd suggest running a full malwarebytes scan, making sure Windows is up to date, and using Windows Defender from now on (nothing else is necessary). Even though you say your computer was wiped, that means little. I've wiped a computer, set it up perfectly with no infection and had the same computer back a week later with a fresh infection.

Either way, this doesn't seem like something you need to be too concerned about. Delete the bookmarks, run some anti-malware scans, and keep everything up to date going forward.

(I worked in home computer repair for many years before coming to Mozilla and I've seen it all, so don't get offended when I give you my honest opinion) This is a case of one of the following being true: # (Most likely) Someone who had access to your computer created these bookmarks. Younger Siblings, Spouse, Nieces and Nephews, Grandparents, etc. It may be that these were created in another browser (like IE) and then imported into Firefox, but that's the most likely story of how they came to be. # (If the above is absolutely not possible) Then Malware created those bookmarks, though in all my years of experience very few malware infections would create bookmarks, it is possible. I'd suggest running a full malwarebytes scan, making sure Windows is up to date, and using Windows Defender from now on (nothing else is necessary). Even though you say your computer was wiped, that means little. I've wiped a computer, set it up perfectly with no infection and had the same computer back a week later with a fresh infection. Either way, this doesn't seem like something you need to be too concerned about. Delete the bookmarks, run some anti-malware scans, and keep everything up to date going forward.
cor-el
  • Top 10 Contributor
  • Moderator
17519 solutions 158415 answers

These bookmarks were created in 2013 and 2014 according to the screenshot, so it is not possible to reconstruct how this happened. Maybe someone has used you computer during that time.

If there aren't any recent bookmarks of this kind then you can safely remove them.

These bookmarks were created in 2013 and 2014 according to the screenshot, so it is not possible to reconstruct how this happened. Maybe someone has used you computer during that time. If there aren't any recent bookmarks of this kind then you can safely remove them.

Question owner

Thank you for your honesty, but as much as I'd love to say that someone had access and did this, no, they didn't. No one has had access but me. They are websites that I have not visited and certainly not websites that I would save links to. As said. I never use "Other Folders". I had no idea that they were there. If I did use the "Other Folders" folder, then that folder would include many of the other normal links that I have saved over the years, but no. Nothing.

The last link stored was 19th March 2014 then they suddenly stopped. It just so happens that my Kapersky anti-virus was updated on the 1st April 2014, I doubt it's a coincidence that no more ever came. I believe that the update prevented further Malware (?) spam links. I believe this confirms Malware and I believe it because I know who I am and what I do!

Thank you for your honesty, but as much as I'd love to say that someone had access and did this, no, they didn't. No one has had access but me. They are websites that I have not visited and certainly not websites that I would save links to. As said. I never use "Other Folders". I had no idea that they were there. If I did use the "Other Folders" folder, then that folder would include many of the other normal links that I have saved over the years, but no. Nothing. The last link stored was 19th March 2014 then they suddenly stopped. It just so happens that my Kapersky anti-virus was updated on the 1st April 2014, I doubt it's a coincidence that no more ever came. I believe that the update prevented further Malware (?) spam links. I believe this confirms Malware and I believe it because I know who I am and what I do!

Question owner

Also hoping Seburo will chime in. He/she claims to have seen exactly what I am describing.

Also hoping Seburo will chime in. He/she claims to have seen exactly what I am describing.
Seburo
  • Top 10 Contributor
  • Moderator
795 solutions 5874 answers

Hi

Wow, okay. Thank you for posting those images, makes it very clear what you are seeing.

Before I venture any opinion of my own, I recommend following the advice of Tyler Downer, cor-el, Scribe and jscher2000. They are far smarter and more experienced than I am .

I have seen something like this before in a different browser, many years ago. That instance was malware, in particular adware, that burrowed its way into the Windows Registry (from which I removed it, manually). Mr Downer is right, this stuff can be virulent, but can also be removed. To help narrow down what you are seeing to point you in the right direction of a fix, I have a couple of questions:

  • When you search in Firefox, what search engine is being used by default? Do the results display as they should for that search engine?
  • What add-ons do you have listed in the Extensions category when you type about:addons into the address bar?

Please make sure you run a full malware scan using the package you have install, being sure to tick all the boxes to make sure it is a full and complete scan. If any malware is highlighted, make a note of the name (which may look like it is in code) and include that in your response.

Hi Wow, okay. Thank you for posting those images, makes it very clear what you are seeing. Before I venture any opinion of my own, I recommend following the advice of Tyler Downer, cor-el, Scribe and jscher2000. They are far smarter and more experienced than I am . I have seen something like this before in a different browser, many years ago. That instance was malware, in particular adware, that burrowed its way into the Windows Registry (from which I removed it, manually). Mr Downer is right, this stuff can be virulent, but can also be removed. To help narrow down what you are seeing to point you in the right direction of a fix, I have a couple of questions: * When you search in Firefox, what search engine is being used by default? Do the results display as they should for that search engine? * What add-ons do you have listed in the Extensions category when you type about:addons into the address bar? Please make sure you run a full malware scan using the package you have install, being sure to tick all the boxes to make sure it is a full and complete scan. If any malware is highlighted, make a note of the name (which may look like it is in code) and include that in your response.

Modified by Seburo